Hackers heated freezers to 50 degrees in more than 115 shops across Europe - and didn't ask for a cent

On the night between Sunday and Monday, at around two in the morning, someone remotely got into the refrigeration system of an ICA supermarket in Stockholm and turned the freezers up to 50 degrees. Staff only found out a few hours later when they arrived for work. "There was a hacker attack and all our freezers reached 50 degrees. Everything is ruined," said Engla Ingval, a sales manager at one of the stores.

Stockholm was no exception. According to the specialist site Bleeping Computer, more than 115 shops in at least six countries were hit. Incidents were reported in Sweden, Belgium, Luxembourg, Ireland, the Netherlands and Estonia, with similar problems in Finland. On the island of Öland a freezer reached 55 degrees and the shop floor was under water from melted ice. Swedish chain Coop confirmed problems in seven of its more than 800 stores.

In Belgium the targets were Delhaize, Carrefour, Spar and Intermarché. Carrefour confirmed that the attackers compromised refrigeration equipment in 15 of its stores, and shoppers in some of them were greeted by empty fridges and a notice that fresh and frozen products temporarily could not be bought because of a hacker attack. An IKEA store in Mons was hit too. In Ireland the attack reached 13 SuperValu stores, in the Netherlands at least 17 smaller shops and butchers. In Estonia staff reacted within minutes and there was no major damage.

The method is humiliatingly simple. Stefan Mulans, director of the Belgian company Sabkobel, which maintains refrigeration systems in some of the supermarkets, confirmed that the attackers remotely switched on defrost mode. "We started mobilising technicians at one in the morning. All night and all morning we were shutting down affected installations," he said.

This isn't the first time. In mid-October an almost identical attack hit hundreds of supermarkets in France - Intermarché, Carrefour, Leclerc and Monoprix. Temperatures in some units jumped from minus 27 to over 50 degrees, food spoiled, and fires were reported at some sites. The damage in France is estimated at tens of millions of euros, and individual shops lost more than 130,000 euros.

Investigators suspect the attackers exploited security holes in remote-management systems, some of which were connected directly to the internet. Among those hit were devices made by Danish company Danfoss, which had previously warned customers to install security updates. Cybersecurity expert Tom Hegel of SentinelOne warns that supermarkets are particularly vulnerable because they run a large number of interconnected systems for cooling, heating, building access and payments.

The strangest detail: nobody demanded a ransom. That is why experts are considering the possibility that the goal was not extortion but deliberate economic damage and disruption of the food supply. EU Commissioner for Agriculture and Food Christophe Hansen called the repeated attacks very worrying and an attempt to disrupt the supply chain and consumer confidence. If one night is enough for empty shelves in several European countries, the question is simple: who checks the refrigeration systems in Balkan shops - and would anyone even notice before morning?